Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions .dockerignore
Original file line number Diff line number Diff line change
@@ -1,3 +1,19 @@
# More info: https://docs.docker.com/engine/reference/builder/#dockerignore-file
# Ignore build and test binaries.
bin/
target/
.venv/
.pytest_cache/
.ruff_cache/
.git/
.github/
*.egg-info/
__pycache__/
*.pyc
*.pyo
.DS_Store
.env
docker-compose*.yml
docs/
examples/
python/tests/
5 changes: 4 additions & 1 deletion .github/workflows/rust-ci.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -36,5 +36,8 @@ jobs:
with:
toolchain: stable

- name: Run tests
- name: Run Unit tests
run: make test

- name: Run E2E tests
run: make test-e2e
42 changes: 21 additions & 21 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Empty file removed Dockerfile
Empty file.
39 changes: 39 additions & 0 deletions Dockerfile.alpine
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
# Multi-stage build for SandD daemon - Alpine Linux (musl-based)
# Build with musl target for Alpine compatibility
FROM rust:1.85-alpine as builder

WORKDIR /app

# Install build dependencies for Alpine
RUN apk add --no-cache \
musl-dev \
pkgconfig \
openssl-dev \
openssl-libs-static

# Copy workspace files
COPY Cargo.toml Cargo.lock ./
COPY sandd/ ./sandd/
COPY server/ ./server/

# Build the daemon binary in release mode
# Alpine uses musl libc, which is already the default target
RUN cargo build --package sandd --release

# Runtime stage - Alpine for minimal size
FROM alpine:3.21

# Install runtime dependencies
RUN apk add --no-cache \
ca-certificates \
libgcc

# Copy the binary from builder
COPY --from=builder /app/target/release/sandd /usr/local/bin/sandd

# Set working directory
WORKDIR /workspace

# Default command - can be overridden
ENTRYPOINT ["/usr/local/bin/sandd"]
CMD ["--help"]
38 changes: 38 additions & 0 deletions Dockerfile.debian
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
# Multi-stage build for SandD daemon
# Use latest Rust for building
FROM rust:1.85-slim as builder

WORKDIR /app

# Install build dependencies
RUN apt-get update && apt-get install -y \
pkg-config \
libssl-dev \
&& rm -rf /var/lib/apt/lists/*

# Copy workspace files
COPY Cargo.toml Cargo.lock ./
COPY sandd/ ./sandd/
COPY server/ ./server/

# Build the daemon binary in release mode
RUN cargo build --package sandd --release

# Runtime stage - use trixie for newer glibc
FROM debian:trixie-slim

# Install runtime dependencies
RUN apt-get update && apt-get install -y \
ca-certificates \
libssl3 \
&& rm -rf /var/lib/apt/lists/*

# Copy the binary from builder
COPY --from=builder /app/target/release/sandd /usr/local/bin/sandd

# Set working directory
WORKDIR /workspace

# Default command - can be overridden
ENTRYPOINT ["/usr/local/bin/sandd"]
CMD ["--help"]
38 changes: 38 additions & 0 deletions Dockerfile.rocky
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
# Multi-stage build for SandD daemon - Rocky Linux (RHEL-based)
# Use Rust builder stage
FROM rust:1.85-slim as builder

WORKDIR /app

# Install build dependencies
RUN apt-get update && apt-get install -y \
pkg-config \
libssl-dev \
&& rm -rf /var/lib/apt/lists/*

# Copy workspace files
COPY Cargo.toml Cargo.lock ./
COPY sandd/ ./sandd/
COPY server/ ./server/

# Build the daemon binary in release mode
RUN cargo build --package sandd --release

# Runtime stage - Rocky Linux 9
FROM rockylinux:9-minimal

# Install runtime dependencies
RUN microdnf install -y \
ca-certificates \
openssl-libs \
&& microdnf clean all

# Copy the binary from builder
COPY --from=builder /app/target/release/sandd /usr/local/bin/sandd

# Set working directory
WORKDIR /workspace

# Default command - can be overridden
ENTRYPOINT ["/usr/local/bin/sandd"]
CMD ["--help"]
26 changes: 24 additions & 2 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -2,17 +2,20 @@ RUFF := .venv/bin/ruff
PYTEST := .venv/bin/pytest
MATURIN := .venv/bin/maturin

.PHONY: help build install dev test clean daemon-build daemon-release
.PHONY: help build install dev test clean daemon-build daemon-release test-e2e docker-build docker-down

help:
@echo "SandD - Sandbox Daemon - Build Commands"
@echo ""
@echo " make build - Build Python package (debug mode)"
@echo " make install - Install Python package locally"
@echo " make dev - Install in development mode with hot reload"
@echo " make test - Run tests"
@echo " make test - Run unit and integration tests"
@echo " make test-e2e - Run end-to-end tests with Docker"
@echo " make daemon-build - Build daemon binary (debug)"
@echo " make daemon-release - Build daemon binary (release)"
@echo " make docker-build - Build Docker image for daemon"
@echo " make docker-down - Stop and remove Docker containers"
@echo " make clean - Clean build artifacts"

build: $(MATURIN)
Expand Down Expand Up @@ -48,6 +51,25 @@ clean:
rm -rf python/sandd.egg-info/
find . -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null || true

test-e2e: $(PYTEST) dev
@echo "Building Docker images..."
docker compose -f docker-compose.e2e.yml build
@echo ""
@echo "Running E2E tests with Docker..."
$(PYTEST) python/tests/test_e2e.py -v -s
@echo ""
@echo "Cleaning up containers..."
docker compose -f docker-compose.e2e.yml down

docker-build:
docker compose -f docker-compose.e2e.yml build

docker-down:
docker compose -f docker-compose.e2e.yml down

test-all: test test-e2e
@echo "All tests completed successfully"

.PHONY: lint
lint: $(RUFF)
$(RUFF) check .
Expand Down
8 changes: 6 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@

# SandD

**Sandbox Daemon for Secure Remote Command Execution**
**A Lightweight Sandbox Daemon for Secure Agent Execution in Isolated Environments.**

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![Rust](https://img.shields.io/badge/rust-1.70+-orange.svg)](https://www.rust-lang.org/)
[![Python](https://img.shields.io/badge/python-3.8+-blue.svg)](https://www.python.org/)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)

Rust-powered WebSocket server with Python API for secure command execution in isolated environments.

Expand Down Expand Up @@ -114,6 +114,10 @@ print(f"Output: {result.stdout}")
# ... repeat for n+ machines
```

## Examples

See the [examples/](./examples) directory for common use cases.

## Development

See [DEVELOP.md](./docs/DEVELOP.md) for the complete developer guide including build commands, testing, and troubleshooting.
Expand Down
Loading
Loading